Extracted

• • Target
    4906946356556994be775cd92c8da8f7a7eca0634a0e22c6fe4118b2782a815f.bin
  • Size 14.3MB
  • SHA256 4906946356556994be775cd92c8da8f7a7eca0634a0e22c6fe4118b2782a815f
  • MD5 159fa44861ff76cf4b79dab3df91a5ca
  • SHA1 06ea36e3d419574e6bc2ac0f9a0c9488c51f2f8c
  • SHA512 a23483c85c5cc0a806f6d01ecd2f944640370f97e3389dad31b8c5c289bab65ac19c73a744b7e24d914e1ee8ba4d58bc27ba885086fb952d6594b498f4cdec2f
  • SSDEEP 6144:O1VCbRFuzFHpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:887KFHp
  • TLSH
    T181E62A29847B28F5C670107CF78C7B7EAAFD06F49EB4015B689C97C1E4289D454ECAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontofseepersistenceprivilege_escalationtrojan

  • Family: Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    defense_evasiontrojan

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2